What is GHSA-jfq2-rj7f-9gvf?

GHSA-jfq2-rj7f-9gvf is a security advisory published by GitHub Security Advisories with High severity. Null pointer dereference in TensorFlow leads to exploitation

Which CVE IDs does GHSA-jfq2-rj7f-9gvf cover?

GHSA-jfq2-rj7f-9gvf covers the following CVE IDs: CVE-2018-7576. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jfq2-rj7f-9gvf?

GHSA-jfq2-rj7f-9gvf has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-jfq2-rj7f-9gvf?

GHSA-jfq2-rj7f-9gvf affects 2 products, including: pip/tensorflow:\u003e= 1.0.0, \u003c 1.6.0; pip/tensorflow-gpu:\u003e= 1.0.0, \u003c 1.6.0.

GHSA-jfq2-rj7f-9gvfHighCVSS 6.5

Null pointer dereference in TensorFlow leads to exploitation

Vendor

GitHub Security Advisories

Published

April 24, 2019

Last Modified

October 28, 2024

🔗 CVE IDs covered (1)

CVE-2018-7576 →

📋 Description

Google TensorFlow 1.0.0 through 1.5.1 is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

🎯 Affected products2

pip/tensorflow:>= 1.0.0, < 1.6.0
pip/tensorflow-gpu:>= 1.0.0, < 1.6.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2018-7576
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-002.md
https://github.com/tensorflow/tensorflow/commit/c48431588e7cf8aff61d4c299231e3e925144df8
https://github.com/advisories/GHSA-jfq2-rj7f-9gvf
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2019-224.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2019-231.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2019-206.yaml